openSUSE 16 Security Update : forgejo-cli (openSUSE-SU-2026:21605-1)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# openSUSE Security Update openSUSE-SU-2026:21605-1. The text itself
# is copyright (C) SUSE.
##

include('compat.inc');

if (description)
{
  script_id(338630);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/21");

  script_cve_id("CVE-2025-3416", "CVE-2025-55159", "CVE-2026-25541");

  script_name(english:"openSUSE 16 Security Update : forgejo-cli (openSUSE-SU-2026:21605-1)");

  script_set_attribute(attribute:"synopsis", value:
"The remote openSUSE host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the
openSUSE-SU-2026:21605-1 advisory.

    Changes in forgejo-cli:

    - Update vendored bytes crate to 1.12.1
      * CVE-2026-25541: Fixed an integer overflow in BytesMut::reserve that could
        corrupt the tracked capacity and lead to out-of-bounds slices (boo#1274529).

    - update to 0.6.0:
      * Localization!
        - forgejo-cli has gained localization support!
          You can now use it in your preferred language, just like
          Forgejo itself.
          Currently de-DE and zh-Hans are included, with several more
          being in-progress.
          See the project on Codeberg Translate if you want to help out
          with any languages you know!
          https://translate.codeberg.org/projects/forgejo-cli/forgejo-cli/
      * Additions
        - (!586) fj issue/pr view assignees to see who is assigned to
          an issue or pull request
        - (!582) --avatar/--unset-avatar options on fj repo edit
        - (!554) fj repo star-status to check if you've starred a repo
        - (!547) --cwd option to set the working directory a command is
          run in
        - (!533, !561) Commands to watch and unwatch repos
        - (!462) Resolve SSH host names from SSH config
        - (!279, !464, !472, !489, !491, !513, !594) Localization
        - Added fj auth login support for the following instances:
          - v16.next.forgejo.org
          - v17.next.forgejo.org
        - Removed fj auth login support for the following instances
          that have shut down:
          - v7.next.forgejo.org
          - v12.next.forgejo.org
      * Changes
        - (!535) Added an error message when fj auth login fails to
          open the browser
        - (!523) fj auth add-key was renamed to fj auth add-token. An
          alias still exists to add-key, so this isn't a breaking
          change.
        - (!514) The --host flag can now be anywhere in the command,
          instead of only the beginning
        - (!504) fj auth add-token no longer takes a username argument.
      * Fixes
        - (!579) Fixed fj issue unassign incorrectly unassigning
          everyone except the intended users
        - (!569) Fixed display of labels failing when a label is marked
          as exclusive but does not contain a slash
        - (!542) Fixed parsing of SSH shorthand urls
        - (!510) Fixed fj pr checkout failing when the instance URL
          contained a port
        - (!437) Fixed incorrect parsing of activity info
      * Other
        - (!573) Use rust 2024 edition
        - (!560) Simplify determining repo owner
        - (!531) Fix clippy warnings
        - (!527) Remove unused dependencies, narrow tokio features
        - (!526) Replace crossterm with terminal_size
        - (!520) Optimize cargo release profile
        - (!469) Fix typo
        - (!449) Restricted file permissions at creation time
        - (!443) Add oneline helptext to 'repo migrate' command

    - update to 0.5.0:
      * Additions
        - (!334) Support for managing labels on issues and repos.
        - (!349) repo edit and repo units for modifying settings on a
          repo and repo units.
        - (!373) Use the needed CLI flags for more editors when opening
          them.
        - (!385) Use the editor defined in git's core.editor config
          option by default (falling back to $EDITOR if it is not set).
        - (!414) Add commands to assign and unassign users to issues
          and PRs.
        - (!415) Support all README files in fj repo readme, regardless
          of case or extension.
        - (!416) Add the option to choose what repo to own the new repo
          to fj repo migrate.
        - (!419) Show a warning when viewing an archived repo.
        - (!420) Add a notice about git push --force not being
          supported on AGit PRs.
        - Added fj auth login support for the following instances:
          - v15.next.forgejo.org
          - codefloe.com
      * Fixes
        - (!393) Don't include pull requests in fj issues search.
        - (!407) Guarantee opening the browser in fj auth login doesn't
          block.
        - (!417) Prevent incorrectly reusing the refresh token when
          refreshing OAuth tokens.
      * Other
        - (!278) Improved no repo info error message.
        - (!403) Build aarch64 artifacts for new releases.

    - update to 0.4.1:
      * Fixes
        - (!368) Generate the correct PKCE challenge verifier. This was
          preventing fj auth login from succeeding.

    - Update to version 0.4.0:
      * Support for issue & pull request templates with fj issue/pr create
        --template
      * fj pr create --autofill, which will automatically populate the PR's title
        and body from the commit(s)
      * fj user key and fj user gpg commands for managing uploaded SSH and GPG keys
      * fj user repos --page, to select the page of results to view
      * fj issue/pr create/comment --body-from-file to use the contents of a file
        as the body
      * --identity-file/-I flag for selecting the SSH identity to use
      * fj tag to manage git tags
      * fj issue search --state all
      * --remote & --repo flags can now be at the end of the command with the rest
        of the flags

    - update to 0.3.0:
      * Additions
        - Added fj completion to generate completion scripts for various
          shells
        - Added fj org for Organization commands.
        - Added fj actions for Forgejo Actions-related commands (thank
          you, @LordMZTE !)
        - OAuth client IDs for fj auth login can now be customized.
        See the wiki for more on the new features.
            https://codeberg.org/Cyborus/forgejo-cli/wiki/Organizations
      * Fixes
        - Keys file now has proper file permissions
        - Fixed incorrect help commands (thank you, @0ko !)
        - Always set user agent in requests

    - update to 0.2.0:
      * Additions
        - pr create and issue create now have a --web flag that opens
          the creation page in your browser instead of creating it on
          the terminal.
        - pr --agit will create a pull request with agit flow, so you
          don't need to fork the repository.
        - pr status --wait will only exits once all PR checks finish.
        - repo migrate to migrate/mirror repositories from other hosts.
        - repo readme to print a repository's readme to the terminal.
        - version --verbose prints extra info useful for debugging
      * Fixes
        - Public endpoints can now be accessed without authenticating
        - The API will be accessed via the http url even when it
          differs from the ssh url and the local remote points to the
          ssh url.
        - browse commands will no long hang the terminal
        - Local repos will now be found even when in a subdirectory
        - SSH urls in repo remotes will now be parsed correctly
        - Improved pull request detection

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1242683");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1248047");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1274529");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2025-3416");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2025-55159");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-25541");
  script_set_attribute(attribute:"solution", value:
"Update the affected forgejo-cli package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-25541");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/04/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/18");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/21");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:forgejo-cli");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:16.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"SuSE Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include('rpm.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/SuSE/release');
if (isnull(os_release) || os_release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, 'openSUSE');
var _os_ver = pregmatch(pattern: "^SUSE([\d.]+)", string:os_release);
if (isnull(_os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'openSUSE');
_os_ver = _os_ver[1];
if (os_release !~ "^(SUSE16\.0)$") audit(AUDIT_OS_RELEASE_NOT, 'openSUSE', '16.0', os_release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'openSUSE ' + _os_ver, cpu);

var pkgs = [
    {'reference':'forgejo-cli-0.6.0-bp160.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var _cpu = NULL;
  var rpm_spec_vers_cmp = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (reference && _release) {
    if (rpm_check(release:_release, cpu:_cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'forgejo-cli');
}